CRITICAL Cisco Zero-Day (CVE-2025-20333, CVSS 9.9) Under Active Attack: VPN Flaw Allows Root RCE

Cisco has disclosed a zero-day vulnerability affecting its Secure Firewall ASA and Threat Defense software, tracked as CVE-2025-20333 with a CVSS score of 9.9, which could allow remote attackers with valid VPN credentials to fully compromise affected devices. According to Cisco, the flaw resides in the VPN web server and could let an authenticated, remote attacker execute arbitrary code on an affected device.

The vulnerability exists due to improper validation of user-supplied input in HTTP(S) requests and could allow code execution as root, potentially leading to complete device compromise. Devices running ASA or FTD software are at risk if configured with AnyConnect IKEv2 Remote Access, Mobile User Security, or SSL VPN; Cisco has confirmed that this does not affect Cisco Secure FMC Software.

The Cisco PSIRT is aware of attempted exploitation in the wild, and Cisco has released software updates and recommended upgrading to a fixed release, along with guidance to mitigate login authentication attacks and client initiation abuses.